SeychellesData Protection Act, 2023, sensitive data and data of minors
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not process race, ethnic origin, biometric, genetic, political, religious or health-related personal data unless a specific exception in section 22 applies.
- Obtain consent from a parent or legal guardian before processing the personal data of a person below 18 years, and verify that such consent has been given.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 22 to 24 bar processing of sensitive data except on stated grounds, require a parent or guardian’s consent for a child under 18 (or verification that it was given where the data came from a third party) and limit processing of conviction data to official control. None of them names a log, register or record, and verifying that consent was given is not a duty to keep a record of it. The Commission’s inspection power sits in section 7, and the record duties in sections 37 and 38, none of which this row cites.
- Kind
- None
- As of
What this law does
Processing of personal data relating to race, ethnic origin, biometrics, genetics, political opinions, religious or philosophical beliefs, or for identifying a person's health or sex life, is prohibited unless a specific exception applies, such as the data subject's explicit consent, protection of vital interests, or the data being manifestly made public by the data subject.
No person may process a child's personal data (a person below 18 years) without consent from the child's parent or legal guardian.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .